{"uid":"cap_H2Yo5o5ioAhlLqaoigM7-","slug":"api-strale-io-9c9f02da","name":"Strale Secret Scanner","description":"Scan code/config/logs for leaked secrets: AWS keys, GitHub tokens, Stripe keys, API keys, private keys, DB URLs, JWTs. Algorithmic regex matching.","url":"https://api.strale.io/x402/secret-scan","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","required":["text"],"properties":{"text":{"type":"string","description":"Code, config, or log output"}}}},"additionalProperties":false}}},"responseSchema":null,"example":{"request":{"text":"const apiKey = \"sk_test_4eC39HqLyjWDarhtT657j8nt\"; const dbUrl = \"mongodb://user:pass@localhost:27017/testdb\"; function authenticate() { return 'token_abc123xyz'; }"},"response":{"_meta":{"payment":{"method":"x402","price_usd":0.0216,"settlement_id":"0xae1bb4d1ab2aaf4f9e6a29dfbe8f86c2f83189430c0332c079f84c4375e71447"},"capability":"secret-scan","latency_ms":0,"provenance":{"source":"algorithmic","fetched_at":"2026-06-13T04:24:01.353Z"}},"clean":false,"findings":[{"type":"stripe_secret_key","severity":"critical","line_number":1,"masked_value":"sk_t...j8nt","pattern_matched":"stripe_secret_key"},{"type":"database_url","severity":"critical","line_number":1,"masked_value":"mong...stdb","pattern_matched":"database_url"},{"type":"generic_secret","severity":"high","line_number":1,"masked_value":"apiK...8nt\"","pattern_matched":"generic_secret"}],"lines_scanned":1,"total_findings":3,"severity_summary":{"high":1,"medium":0,"critical":2}}},"exampleRequest":{"text":"const apiKey = \"sk_test_4eC39HqLyjWDarhtT657j8nt\"; const dbUrl = \"mongodb://user:pass@localhost:27017/testdb\"; function authenticate() { return 'token_abc123xyz'; }"},"tags":["x402"],"displayCostAmount":"0.0216","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.0216/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0216","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0216","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_grwjw7-4N61GwKJrdPtoH","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0216","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Scans code, config files, or log output for leaked secrets using algorithmic regex matching, detecting AWS keys, GitHub tokens, Stripe keys, API keys, private keys, DB connection strings, and JWTs","exampleAgentPrompt":"Can you scan this code snippet for any leaked secrets like AWS keys, API tokens, or database URLs? Here's the text: 'const AWS_KEY = \"AKIA1234EXAMPLE5678\"; const DB_URL = \"postgres://admin:password@db.example.com/prod\";'","exampleUseCases":[{"title":"Pre-deployment credential audit","prompt":"Before I push this code to production, can you scan it for any accidentally hardcoded secrets? I want to make sure there are no AWS keys, database passwords, or API tokens hiding in there."},{"title":"Compliance log inspection","prompt":"We need to audit our application logs from last week to check if any sensitive credentials like JWTs or Stripe keys got logged by mistake. Can you scan through these logs and flag anything that looks like a leaked secret?"},{"title":"Configuration file security check","prompt":"I just pulled down our environment config files and I'm worried some developers might have checked in actual credentials instead of placeholders. Can you scan these files and tell me if there are any exposed API keys, private keys, or database connection strings?"}],"resultDescription":"Returns a list of detected secrets found in the input text, categorized by type (e.g. AWS key, GitHub token, Stripe key, JWT, private key, database URL), along with the matched values or patterns identified via regex analysis.","failureModes":["Missing 'text' query parameter returns validation error","Very large text inputs may be truncated or rejected","False positives on test/example credential strings that match known patterns","False negatives on heavily obfuscated or non-standard secret formats","Network timeout for extremely long log outputs"],"whenToPreferThis":"Use this endpoint when you need fast, algorithmic regex-based secret detection across code snippets, config files, or log output — especially for well-known secret formats like AWS keys, GitHub tokens, Stripe keys, JWTs, and database URLs. Prefer this over LLM-based scanning when you need deterministic, low-latency results and aren't dealing with highly obfuscated or custom secret formats.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T13:07:12.958Z","isFirstParty":false}